Orchestrate bug bounty workflows with impact validation and CVSS 3.1 scoring.
npx skills add https://github.com/uphiago/recon-skills --skill bug-bounty-uphiago
Please help me install this Agent Skill. Skill: bug-bounty Source: https://github.com/uphiago/recon-skills/tree/main/redteam/bug-bounty Command: npx skills add https://github.com/uphiago/recon-skills --skill bug-bounty-uphiago
Bug bounty hunting is often disorganized, with researchers wasting hours on theoretical bugs, shallow reconnaissance, or low-impact findings that never qualify for a payout. This skill eliminates that wasted effort by providing a strict, impact-first workflow that filters out non-exploitable issues immediately and focuses on high-severity, chainable vulnerabilities that deliver real value to programs.
Use this skill to conduct a complete authorized bug bounty assessment for a new target, from initial scope verification through validated high-impact vulnerability reporting.
High-intent search queries and answers about installing and using this skill.
Bug bounty reconnaissance requires an impact-first workflow that eliminates theoretical findings early. By applying a 7-question validation gate, you identify crown jewel assets and avoid dead-end targets before wasting effort on non-exploitable vulnerabilities.
A-to-B attack chaining is a vulnerability hunting methodology that links individual low-severity bugs into a critical exploit path. An example is chaining an SSRF vulnerability to cloud metadata exfiltration, turning isolated findings into high-severity reports that deliver real value to bug bounty programs.
Professional bug bounty report writing uses a human-tone template generation process that incorporates CVSS 3.1 scoring. This ensures your vulnerability report is program-compliant, clearly communicates impact, and maximizes payout potential for validated high-severity findings.
Yes, the bug bounty workflow covers AI and LLM feature testing alongside 30+ other vulnerability classes. It applies the same structured reconnaissance and impact validation to identify and report exploitable security issues in AI-integrated application features.
The best way to avoid dead-end bug bounty targets is applying a 5-minute/one-hour rule alongside an impact-first guardrail. This strict time management prevents wasted effort on theoretical bugs by forcing you to validate exploitability and severity before deeper reconnaissance.
dreadnodeEnumerate HackerOne program scope and generate prioritized target inventories.
jassicsNormalize and deduplicate vulnerability scan findings from multiple scanners.
Carlos-Reyes-UTPGuide end-to-end bug bounty workflows from recon to validated vulnerability reporting.
ripgraphicsExecutes a structured penetration testing workflow from reconnaissance to reporting.
